CVE-2026-69149 Details
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular platform server's DOM emulation dependency, domino. This issue affects versions of @angular/platform-server prior to 20.3.27, 21.2.19, and 22.0.7. The vulnerability arises when the server-side rendering (SSR) process serializes content from fallback raw-content elements, such as <iframe>, <noembed>, <noframes>, and <noscript>. Under SSR, domino treats these elements as raw-text, but the serializer previously failed to escape closing tags in dynamic content, allowing injected scripts to execute in the user's browser context.
Users can update to @angular/platform-server versions 20.3.27, 21.2.19, or 22.0.7 to address this vulnerability. If an immediate update is not possible, the critical CSS inlining can be disabled to prevent the issue temporarily.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/angular/angular/pull/69675 | [email protected] | Issue Tracking |
| https://github.com/angular/angular/pull/69714 | [email protected] | Issue Tracking |
| https://github.com/angular/angular/pull/69929 | [email protected] | Issue Tracking |
| https://github.com/angular/angular/pull/69930 | [email protected] | Issue Tracking |
| https://github.com/angular/angular/security/advisories/GHSA-vpx6-8pjr-4g3v | [email protected] | Vendor AdvisoryMitigation |
| https://github.com/angular/domino/commit/f88e5aa49cf2804d7c2df22ef1640eb4ec43dd56 | [email protected] | Patch |
| https://github.com/angular/domino/pull/32 | [email protected] | Issue Tracking |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| angular angular | <= 19.2.25 >= 20.0.0, < 20.3.27 >= 21.0.0, < 21.2.19 >= 22.0.0, < 22.0.7 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 11, 2026 | Initial Analysis | [email protected] |
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | New CVE Received | [email protected] |